Israeli Ad Tech Firm Allegedly Exploited Starlink for User Surveillance
Researchers identify suspicious ad bidding patterns used to geolocate and track satellite internet users.
1Surveillance via Ad Bidding
Researchers at TrendAI discovered that Israeli ad tech firm Discover-Tech heavily targeted Starlink users through digital advertising auctions. By participating in complex bidding systems, the company allegedly sought to geolocate or surveil individuals using SpaceX’s satellite internet. This method leverages the inherent data leakage within standard programmatic advertising infrastructure to track users.
2Global Bidding Dominance
Discover-Tech emerged as the top bidder for Starlink traffic across more than 100 countries, including regions where the service is restricted. TrendAI identified the firm as the primary entity behind the codename Shadow-Earth-79. The company secured an implausibly dominant share of ad bids in conflict zones like Syria, Yemen, and South Sudan.
3Mechanism of Data Leakage
The ad bidding process allows bidders to collect and collate leaked user data. By merging this information with other datasets, entities can de-anonymize individuals and follow their movements across the web. In some instances, this intelligence gathering facilitates the deployment of targeted surveillance software against sensitive networks, including media organizations and government entities.
4Industry Exposure and Response
Following investigations by Citizen Lab and Confiant, major platforms including Google and Comcast removed Discover-Tech from their advertising ecosystems. At least one large US tech company and an international organization have launched internal inquiries to determine if their employees were targeted by the firm’s suspicious bidding activity during the recent operational period.
5Strategic Value of Starlink
Tracking Starlink users has become a critical objective for various governments due to the service's ability to bypass national telecommunications regulations. Because Starlink routes data through SpaceX satellites, it remains vital for frontline communications in conflict zones like Ukraine. This unique capability makes its users high-value targets for sophisticated digital surveillance operations.
6Internal Attribution Conflicts
TrendAI researchers initially debated naming Discover-Tech in their October 15 report but ultimately opted for the codename Shadow-Earth-79. Sources indicate that executives raised legal concerns regarding public attribution. The company stated its approach aims to avoid hype-driven labels and prevent the distortion of risk prioritization, though this decision sparked significant internal debate.
7Cybersecurity Self-Censorship
The incident highlights a broader trend of self-censorship within the cybersecurity industry, where firms often avoid naming state-backed or powerful actors to prevent potential retribution. Similar to Palo Alto’s previous decision to omit references to China in a cyberespionage report, companies frequently prioritize operational safety over full transparency when documenting high-stakes digital threats.
8Implications for Digital Defense
The exploitation of ad tech for surveillance underscores a critical vulnerability in global internet infrastructure. As ad bidding systems become tools for intelligence gathering, defenders must re-evaluate how telemetry data is shared. Organizations must now treat advertising platforms as potential vectors for sophisticated tracking, necessitating stricter oversight of third-party bidders within their networks.